Merge pull request #3398 from PrismLibrary/dev/ds/sbom

Adopts Central Package Management and Enables SBOM

Author: dansiegel

Directory.Build.props

@@ -3,6 +3,8 @@
   <PropertyGroup>
     <NeutralLanguage>en</NeutralLanguage>
     <Authors>Brian Lagunas;Dan Siegel</Authors>
+    <Company>Prism Software, LLC</Company>
+    <Copyright Condition="'$(Copyright)'==''">Copyright (C) 2015-$([System.DateTime]::Now.ToString(`yyyy`)) Prism Software, LLC - all rights reserved</Copyright>
     <PackageProjectUrl>https://github.com/PrismLibrary/Prism</PackageProjectUrl>
     <PackageLicenseFile>LICENSE</PackageLicenseFile>
     <PackageIcon>prism-logo.png</PackageIcon>
@@ -152,26 +154,16 @@
           CopyToOutputDirectory="PreserveNewest" />
   </ItemGroup>
 
-  <ItemGroup Condition=" $(UseMaui) != 'true' ">
-    <PackageReference Include="Microsoft.NETFramework.ReferenceAssemblies">
-      <PrivateAssets>all</PrivateAssets>
-      <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
-    </PackageReference>
-  </ItemGroup>
-
-  <ItemGroup Condition=" $(DISABLE_GITVERSIONING) != 'true' ">
-    <PackageReference Include="Nerdbank.GitVersioning"
-                      Condition=" !$(MSBuildProjectDirectory.Contains('e2e')) ">
-      <PrivateAssets>all</PrivateAssets>
-      <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
-    </PackageReference>
-  </ItemGroup>
-
-  <ItemGroup Condition=" $(IsPackable) ">
-    <PackageReference Include="Microsoft.SourceLink.GitHub">
-      <PrivateAssets>all</PrivateAssets>
-      <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
-    </PackageReference>
+  <!-- Versions: Directory.Packages.props (Central Package Management). PrivateAssets=all is implicit. -->
+  <ItemGroup>
+    <GlobalPackageReference Include="Microsoft.NETFramework.ReferenceAssemblies"
+                            Condition=" $(UseMaui) != 'true' " />
+    <GlobalPackageReference Include="Nerdbank.GitVersioning"
+                            Condition=" $(DISABLE_GITVERSIONING) != 'true' AND !$(MSBuildProjectDirectory.Contains('e2e')) " />
+    <GlobalPackageReference Include="Microsoft.SourceLink.GitHub"
+                            Condition=" $(IsPackable) " />
+    <GlobalPackageReference Include="Microsoft.Sbom.Targets"
+                            Condition=" $(IsPackable) " />
   </ItemGroup>
 
 </Project>

Directory.Build.targets

@@ -5,11 +5,21 @@
   </PropertyGroup>
 
   <PropertyGroup Condition=" $(IsPackable) ">
+    <GenerateSBOM>true</GenerateSBOM>
+    <SbomGenerationFetchLicenseInformation>true</SbomGenerationFetchLicenseInformation>
+    <SbomGenerationPackageSupplier>$(Company)</SbomGenerationPackageSupplier>
     <!-- Nuget source link -->
     <SymbolPackageFormat>snupkg</SymbolPackageFormat>
     <PublishRepositoryUrl>true</PublishRepositoryUrl>
     <EmbedUntrackedSources>true</EmbedUntrackedSources>
     <AllowedOutputExtensionsInPackageBuildOutputFolder>$(AllowedOutputExtensionsInPackageBuildOutputFolder);.pdb</AllowedOutputExtensionsInPackageBuildOutputFolder>
   </PropertyGroup>
 
+  <Target Name="SetSbomMetadata"
+          BeforeTargets="GenerateSbomTarget"
+          AfterTargets="GetBuildVersion">
+    <PropertyGroup>
+      <SbomGenerationPackageVersion>$(PackageVersion)</SbomGenerationPackageVersion>
+    </PropertyGroup>
+  </Target>
 </Project>

Directory.Packages.props

@@ -99,9 +99,10 @@
     <PackageVersion Include="Xamarin.UITest" Version="3.0.12" />
   </ItemGroup>
   <ItemGroup>
-    <!-- Global Packages -->
+    <!-- GlobalPackageReference in Directory.Build.props — build-only; not transitive to package consumers -->
     <PackageVersion Include="Microsoft.NETFramework.ReferenceAssemblies" Version="1.0.3" />
     <PackageVersion Include="Nerdbank.GitVersioning" Version="3.9.50" />
     <PackageVersion Include="Microsoft.SourceLink.GitHub" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.Sbom.Targets" Version="4.1.5" />
   </ItemGroup>
 </Project>

src/Directory.Build.props

@@ -7,7 +7,8 @@
     <IsPackable Condition=" '$(IsWpfProject)' ">!$(DisableWpfPublish)</IsPackable>
     <IsPackable Condition=" '$(IsFormsProject)' ">!$(DisableFormsPublish)</IsPackable>
     <IsPackable Condition=" '$(IsUnoProject)' ">!$(DisableUnoPublish)</IsPackable>
-    <ContinuousIntegrationBuild Condition="'$(BUILD_BUILDID)' != ''">true</ContinuousIntegrationBuild>
+    <!-- GitHub Actions sets GITHUB_ACTIONS and CI; other CI hosts often set CI. -->
+    <ContinuousIntegrationBuild Condition="'$(GITHUB_ACTIONS)' == 'true' Or '$(CI)' == 'true'">true</ContinuousIntegrationBuild>
     <ImplicitUsings>enable</ImplicitUsings>
   </PropertyGroup>